Vulnerabilities fixed in Adobe InDesign

Adobe has fixed vulnerabilities in InDesign. A malicious person could exploit the vulnerabilities to gain access to system data, or to execute arbitrary code with permissions of the user. To exploit the vulnerabilities, the malicious party needs local access to the application, or needs to trick ...

Vulnerabilities fixed in Citrix Secure Access Clients

Citrix has fixed vulnerabilities in the Secure Access Client for Windows and Ubuntu. The vulnerability with reference CVE-2023-24491 is located in the Windows client and allows a local malicious person to grant themselves elevated privileges and execute code with privileges of SYSTEM The...

Fedora 38 : mingw-nsis (2023-dfb6cc599f)

The remote Fedora 38 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-dfb6cc599f advisory. Update to 3.09, fixes CVE-2023-37378. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has...

Security Updates for Microsoft Office Products (July 2023) (macOS)

The Microsoft Office Products are missing security updates. It is, therefore, affected by multiple remote code execution vulnerabilities. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 80900 C Tenable, In...

Security Updates for Microsoft Excel Products C2R (July 2023)

The Microsoft Excel Products are missing a security update. It is, therefore, affected by multiple vulnerabilities, as follows: - Two remote code execution vulnerabilities. CVE-2023-33161, CVE-2023-33158 - An information disclosure vulnerability. CVE-2023-33162 Note that Nessus has not tested for...

Security Updates for Microsoft Dynamics 365 (on-premises) (July 2023)

The Microsoft Dynamics 365 on-premises is missing security updates. It is, therefore, affected by multiple vulnerabilities: - A remote attacker can craft a specially-constructed URL which, when accessed by an authorised user, allows the attacker to retrieve cookies, present the user with a dialog...

Adobe Releases Security Updates for ColdFusion and InDesign

Adobe has released security updates to address vulnerabilities affecting ColdFusionlink is external and InDesignlink is external. An attacker can exploit some of these vulnerabilities to take control of an affected system. CISA encourages users and administrators to review the Adobe security...

July 11, 2023—KB5028233 (Security-only update)

None None...

July 11, 2023—KB5028224 (Security-only update)

None None...

July 11, 2023—KB5028228 (Monthly Rollup)

None None...

Guidance on Microsoft Signed Drivers Being Used Maliciously

Executive Summary: Microsoft was recently informed that drivers certified by Microsoft’s Windows Hardware Developer Program MWHDP were being used maliciously in post-exploitation activity. In these attacks, the attacker gained administrative privileges on compromised systems before using the...

Microsoft Guidance for Addressing Security Feature Bypass in Trend Micro EFI Modules

Trend Micro has released CVE-2023-28005 to address a secure boot bypass. Subsequently Microsoft has released the July Windows security updates to block the vulnerable UEFI modules by using the DBX UEFI Secure Boot Forbidden Signature Database disallow list. To exploit this vulnerability, an...

July 11, 2023—KB5028222 (Monthly Rollup)

None None...

July 11, 2023—KB5028186 (OS Build 10240.20048) - EXPIRED

None None...

July 11, 2023—KB5028226 (Security-only update)

None None...

July 11, 2023—KB5028240 (Monthly Rollup)

None None...

Internet Explorer help

None None...

July 11, 2023—KB5028166 (OS Builds 19044.3208 and 19045.3208) - EXPIRED

None None...

Security Updates for Microsoft SharePoint Server 2019 (July 2023)

The Microsoft SharePoint Server 2019 installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities: - A security feature bypass vulnerability exists. An attacker can exploit this and bypass the security feature and perform unauthorized actions...

Security Updates for Microsoft Visual Studio Products (July 2023)

The Microsoft Visual Studio Products are missing security updates. It is, therefore, affected by multiple vulnerabilities: - A vulnerability exist in ASP.NET Core applications where account lockout maximum failed attempts may not be immediately updated, allowing an attacker to try more passwords...